If a browser opens an HTTP connection to a web server and the response headers include the field
Content-Type: audio/mpeg or
Content-Type: application/pdf (for instance). The browser is going to interpret this content as an audio or PDF file. Is going to show downloaded content according to its configuration. If the user saves the files "as...", the browser is going to create a file con disk with that content. The browser won't download any other file than that. Which is one of the questions here.
In the other hand, of course, a virus is nothing but a bunch of bytes. Like any other piece of software expressed in machine code. Then any kind of file could have a virus inside. But under normal circumstances a computer isn't going to execute bytes from an MP3 or PDF file. Even if the virus code is inside that file, it's meaningless.
Finally, if an inexpert user reaches an HTML file, which in turn plays an MP3 file. He could think that using
Save as... is going to save the MP3 file. But in fact it's going to save the HTML file. During that process the browser is going to save more than just one file.